freeipa

#8878 Prevent deletion of 'admin' account with web UI
Closed: fixed by rcritten. Opened by ettlz.

Closed: fixed
Reopen Issue

Issue

I created an additional administrator user called 'ipaadmin' through the web UI and deleted the original 'admin' account (wanting to reserve the latter for local use on specific machines). This worked OK until it was time for a routine IPA server upgrade, and that process then broke.

While on reflection I was likely doing something quite inadvisable, I can't help but feel the UI (or some other element of the IPA stack) should either have failed deleting 'admin', or at least told me doing this was a Very Bad Idea.

Steps to Reproduce

  1. Log into web UI as 'admin'.
  2. Create an account and add it to the IPA administrators group.
  3. Log out, then back in as this new administrator.
  4. Delete the 'admin' account.

Actual behavior

One can delete the 'admin' account with no more resistance than any other account.

Expected behavior

Unable to delete 'admin' account, or lots of warnings that this will wreak havoc upon the realm.

Version/Release/Distribution

freeipa-server-4.9.3-4.fc34.x86_64

Yes, we should add a list of protected users like there is for protected groups.

i also delete admin user and failed to upgrade.

how can i add admin user again?

Metadata Update from @rcritten:
- Issue assigned to rcritten

master:

  • dea35922cd086883c0699646ec39fdef8f0ba579 Prevent the admin user from being deleted

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1821181

Issue linked to bug 1821181

ipa-4-10:

  • 4b02322fc786ee9caaa0380659507a2cec0d4101 Prevent the admin user from being deleted

ipa-4-9:

  • f215d3f45396fa29bdd69f56096b50842df14908 Prevent the admin user from being deleted

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1821181,https://bugzilla.redhat.com/show_bug.cgi?id=2229712 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1821181)

master:

  • e49ec1048db85f514e2db5960f773e5d56fa0cec ipatests: update expected webui msg for admin deletion

ipa-4-10:

  • 13d5e88eb4ebb7a0132cbb050a9d230304ecbcff ipatests: update expected webui msg for admin deletion

ipa-4-9:

  • 7d62d84bdd3c2acd2f4bf70bb5fabf14c72e8ee7 ipatests: update expected webui msg for admin deletion
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.